SHA 256

[Cantor, Scott]

On 11/5/15, 4:06 PM, "users on behalf of csross" <users-bounces at shibboleth.net on behalf of cross at hccs.com> wrote:



>I see the keygen.sh file on a server with shibboleth-sp-2.5.3 installed still
>has default_md=sha1.  Is this what results in a certificate with Signature
>Algorithm: sha1WithRSAEncryption please?.  

Yes, I would assume so.

>Is this setting what is being referred to in the ADFS documentation
>"Shibboleth uses the Secure Hash Algorithm 1 (SHA-1) for signing
>operations"?

No, not at all.

The SP doesn't sign anything by default that ADFS cares about except logout requests. That documentation is talking about the IdP.

>1) If I want to generate a certificate with Signature Algorithm:
>sha256WithRSAEncryption, can I modify the default_md= setting in keygen.sh
>to produce that entry?

I don't know. See www.openssl.org (and if you can't find anything, then you've found whatever I would have found).

>  Is there a document with the available entries for
>default_md=?  I know I can generate my own key/cert pair but if the tool
>works then I want to use it.

www.openssl.org

>2) If I make this change can the ADFS users set to SHA256?

Not related.

>3)  Will this work on version 2.4.3 (I know it is old) as long as my openssl
>version supports sha2?

Yes.

-- Scott